Anti-tampering method and corresponding circuits and electric systems

Abstract: In an electrical system comprising a plurality of electrical devices D1-D5 identified by identification codes ID in respective control sections and interconnected by means of at least one transmission means, if by means of sending and/or reception of said identification codes at least one of the devices is capable of checking whether the system has been tampered with and at least said device (and preferably all) disables its own operation, the user of the system will be alerted immediately. By memorising said identification codes in non-volatile memories programmable only once, customisation of the control sections is extremely simple after production of the circuit and performable by means of simple electrical circuits. Even if the identification code is not camouflaged the need for replacing all the control sections for full operation of the electrical system is in itself a sufficient tampering deterrent.

Description: The present invention relates to an electric circuit identified by an identification code (ID) comprising at least the features according to the preamble of claim 1. A large number of apparatuses commonly used in daily life comprise today electrical systems of the above mentioned type which allow correct operation of said apparatuses. Automotive vehicles are one example. An electrical system for command and control of a plurality of electrical devices in an automotive vehicle comprising a main central control unit in communication therewith is known from patent application PCT W0 90/10559 for example. Said electrical devices comprise at least one electrical operation member and an electronic block for command and control. It is clear that tampering with the electrical system could result in great damage to the equipment and/or its users. A method for ensuring an integrated circuit against unauthorised use and/or copying is known from U.S. patent 4,766,516. In accordance with said document an integrated circuit designed to provide a particular circuit function has at least one additional circuit element not contributing to performance of said circuit function. Said circuit element assumes the form of a subcircuit for control codes and inhibits operation of the remaining part of the integrated circuit unless it is addressed by means of its control code. The control code subcircuit is at least partially formed of a Focused Ion Beam (FIB) or equivalent rays. Part of the control code subcircuit elements can then be formed with apparent functions which are different from their real functions by using again for example a FIB. This method is thus based on the idea of camouflaging the control code in such a manner that copies if any could not be used. The techniques for achieving this can all be applied only during production and in any case before assembly and also require very sophisticated equipment. A generic vehicle security system is known from WO-A-93/05987, the vehicle security system including a coded key, a reader for reading the code of the key and generating an encoded electrical signal, a data transfer bus connected to the rader, and a plurality of units connected to the data transfer bus and rendered operative only upon receipt of a predetermined valid code from the reader, wherein each unit is arranged upon receiving an invalid code to transmit an error code over the data transfer bus to the reader or to other units connected to the bus, and upon detection of an error code on the bus from at least selected ones of the units, other units connected to the bus are rendered inoperative even if the latter units had received valid codes. Said document reports that each unit stores its control code in a one time programmable (OTP) memory, but provides no explanation of what such a memory includes. The purpose of the present invention is to provide a simple and economical circuit to implement an anti-tampering circuit for electrical systems. Said purpose is achieved through the integrated electrical circuit having the characteristics set forth in claim 1. Additions advantageous aspects of the present invention are set forth in the dependent claims. In an electrical system comprising a plurality of electrical devices identified by identification codes memorised in respective control sections and interconnected by means of at least one transmission means, if by means of sending and/or reception of said identification codes at least one of the devices is capable of checking whether the system has been tampered with and that at least said device (preferably all) disables its own operation, the user of the system will be immediately alerted. By memorising said identification codes in non-volatile memories programmed only once, customisation of the control devices is extremely simple to provide after production of the circuit and executable by means of simple electrical circuits. Even if the identification code is not camouflaged, the need to replace all the control sections for full operation of the electrical system is in itself a sufficient deterrent against tampering. Such a method lends itself to use as an anti-theft, for example for vehicles. Indeed, normally in a vehicle there is a central unit which, after execution of an identification procedure (insertion of the correct key for example), permits starting of the vehicle and checking of the electrical devices connected thereto. The thief is thus forced to disconnect and then replace said central unit with another one. Of course if said electrical devices can be activated only by the central unit associated therewith, e.g. by means of the same identification code, it will be necessary to replace said electrical devices subsequently. This can be considered a good deterrent due to the necessary cost and time. The invention is clarified by the description given below considered together with the annexed drawings wherein: FIG. 1 shows the block diagram of an electrical system in accordance with the present invention applied to an automotive vehicle, and FIG. 2 shows the block diagram of an electrical circuit in accordance with the present invention. With reference to FIG. 2 an electrical circuit in accordance with the present invention is identified by an identification code ID and comprises at least the following: a) an operational section OS designed to provide a predetermined circuit function, and b) a control section CS non contributing to provision of the predetermined circuit function and connected to the operational section OS and designed to enable and disable operation thereof. The control section CS comprises the following. c) communication means and specifically a receiver RX designed to receive data corresponding to identification codes from at least one transmission means TM outside the circuit, d) non-volatile memory means MEM designed to memorise said identification code ID, e) comparison means CP designed to compare said data with the identification code ID and to emit a result signal RS corresponding to the result of the comparison, and f) selection means SM designed to enable and disable operation of the operational section OS on the basis of the result signal RS. The memory means MEM can be provided by means of a PROM or EPROM memory. In this case memorisation of the identification code must be done "off-line". Alternatively the memory means MEM can be the type electrically programmable only once and the receiver RX is then connected directly to the memory means MEM and is furthermore suitable for writing an identification code received in the memory means MEM if they do not already contain one. The communication means and in particular a transmitter TX can be connected directly to the memory means MEM and can then be furthermore suitable, after switching-on the circuit, to transmit on at least one transmission means outside the circuit, e.g. the means TM, the content of the memory means MEM if they were programmed previously. In the circuit in accordance with the present invention the comparison means CP in combination with the selection means SM can be such as to keep disabled operation of the operational section OS after switching-on the circuit and at least until reception of the data, e.g. by the means TM. It is particularly advantageous that said electrical circuit be integrated in a chip to ensure greater safety in addition of course to smaller space occupation. Such an electrical circuit is the basic block to be able to implement the method and provide the electrical system in accordance with the present invention. With reference to FIG. 1 an electrical system in accordance with the present invention and in particular for an automotive vehicle V comprises a plurality of electrical devices D1-D5 designed to perform predetermined operations and at least one central unit CU in communication with the electrical devices D1-D5 and designed to permit performance of said operations after execution of an identification procedure. The central unit CU is associated with non-volatile memory means (MEM,K) designed to contain at least one identification code ID and transmission means designed to transmit after switching-on the electrical system to the electrical devices D1-D5 at lest one identification code ID and the electrical devices D1-D5 comprise an electrical circuit like the one described above. In FIG. 2 the devices D2-D5 control e.g. closing of the doors of the automotive vehicle V and the respective window raisers and the device D1 controls the motor MO. The electrical devices can be connected to the central unit CU by means of one or more busses in order to use a smaller number of wires and facilitate wiring of the automotive vehicle. There are virtually two alternative possibilities for provision of the memory means MEM. Said memory means can comprise an internal non-volatile semiconductor memory device MEM inserted in the central unit CU and designed to contain at least one identification code ID. Alternatively said memory means comprise an external identification device K, e.g. an electronic key. In this case the central unit CU must comprise reading means designed to read at least one identification code ID from the external device K. If the memory means comprise both the internal device MEM and the external device K the central unit CU can comprise comparison means designed to compare at least one identification code read from the device K with at least one identification code contained in the device MEM. It can be foreseen that the central unit CU would comprise reception means designed to receive from the electrical devices D1-D5 the identification code memorised in the corresponding memory means and compare them correspondingly with that contained in the memory means (MEM,K) associated with the unit. A simply way of providing, at least partially, the central unit CU would be to use an electrical circuit like that discussed above. Using the electrical circuit and the electrical system discussed, implementation of the method in accordance with the present invention is immediate. Said method consists of providing that, by sending and/or reception of the identification codes, at least one of the electrical devices would be capable of verifying whether the system has been tampered with. This works on the assumption that, because of a tampering event, there is either a device missing from the electrical system or a device has been replaced with another one and the identification code of the latter is wrong. This can be done in various ways which may also depend on the manner in which the electrical devices are connected together and/or in communication. In case of physical or logical loop connection each device could check the presence and correct identification of the device preceding it expecting that the latter would send it its identification code. In case of star connection the device placed in the centre, which could also be a central unit, could check the presence and correct identification of the other devices expecting that they would send their identification code. The device detecting the tampering event disables its own operation or even that of the others. Said device can also inform the other devices which then individually disable their own operation. In a particularly convenient and simple embodiment for being applied in automotive vehicle electrical systems, the electrical system comprises a central unit which, after execution of an identification procedure (e.g. insertion of the ignition key), sends to all the devices the identification codes which can for example be all the same. The devices then check that the code received corresponds to that memorised in their control section and, if it does not, disable their own operation. In case of replacement of an electrical device or at least its control section, e.g. for a failure, it is necessary that in the new control section there be inserted the correct identification code. This can be done "off-line" before the replacement by programming the non-volatile memory means MEM. It can also be provided that it is the control section which will memorise in its memory means MEM the first identification code received by the receiver RX.

Claims: Electric circuit identified by an identification code (ID) comprising at least the following: a) an operational section (OS) designed to provide a predetermined circuit function, and b) a control section (CS) non contributing to provision of the predetermined circuit function and connected to said operational section (OS) and designed to enable and disable operation thereof, wherein said control section comprises: c) communication means (RX,TX) designed to receive data corresponding to identification codes (ID) from at least one external transmission means (TM), d) non-volatile memory means (MEM) designed to memorise said identification code (ID), e) comparison means (CP) designed to compare said data with the identification code (ID) and to emit a result signal (RS) corresponding to the result of the comparison, and f) selection means (SM) designed to enable and disable operation of the operational section OS depending on the result signal (RS), and characterized in that said electrical circuit is integrated on a semiconductor substrate and said memory means (MEM) are electrically programmable only once and said communication means (RX) are directly connected to said memory means (MEM) and are furthermore suitable for writing an identification code (ID) received in said memory means (MEM) if they do not already contain one. Circuit in accordance with claim 1 in which said memory means (MEM) are provided by means of a PROM or EPROM memory. Circuit in accordance with claim 1 in which said transmitter means (TX) are connected directly to said memory means (MEM) and are furthermore suitable for transmitting, after switching-on the circuit, on at least one external means (TM) the content of said memory means (MEM) if they have been programmed previously. Circuit in accordance with claim 1 in which said comparison means (CP) in combination with said selection means (SM) are such as to keep disabled operation of said operational section (OS) after switching-on the circuit and at least until reception of said data.

Inventors: BISIANI ROBERTO, DEGLI ANTONI GIOVANNI, MURARI BRUNO, BISIANI, ROBERTO, DEGLI ANTONI, GIOVANNI, MURARI, BRUNO
Applicants: ST MICROELECTRONICS SRL, STMICROELECTRONICS S.R.L.
Application year: 1994
Main classification: B60R25
IPC codes: B60R25